本文属于机器翻译版本。若本译文内容与英语原文存在差异，则一律以英文原文为准。

# AWS Secrets Manager 密钥的 JSON 结构
<a name="reference_secret_json_structure"></a>

您可以在 Secrets Manager 密钥中存储任何文本或二进制文件，最大大小为 65,536 字节。

如果使用 [通过 Lambda 函数进行轮换](rotate-secrets_lambda.md)，则密钥必须包含轮换函数所需的特定 JSON 字段。例如，对于包含数据库凭证的密钥，轮换函数会连接到数据库以更新凭证，因此该密钥必须包含数据库连接信息。

如果使用控制台编辑数据库密钥的轮换，则该密钥必须包含标识数据库的特定 JSON 键值对。Secrets Manager 使用这些字段查询数据库，以查找存储轮换函数的正确 VPC。

JSON 键名称区分大小写。

**Topics**
+ [Amazon RDS 和 Aurora 凭证](#reference_secret_json_structure_rds)
+ [Amazon Redshift 凭证](#reference_secret_json_structure_RS)
+ [Amazon Redshift Serverless 凭证](#reference_secret_json_structure_RSServerless)
+ [Amazon DocumentDB 凭证](#reference_secret_json_structure_docdb)
+ [Amazon Timestream for InfluxDB 密钥结构](#reference_secret_json_structure_TIME)
+ [Amazon ElastiCache 凭证](#reference_secret_json_structure_ELC)
+ [Active Directory 凭证](#reference_secret_json_structure_AD)

## Amazon RDS 和 Aurora 凭证
<a name="reference_secret_json_structure_rds"></a>

要使用 [Secrets Manager 提供的轮换函数模板](reference_available-rotation-templates.md#RDS_rotation_templates)，请使用以下 JSON 结构。例如，您可以添加更多 key/value 对，以包含其他区域中副本数据库的连接信息。

------
#### [ DB2 ]

对于 Amazon RDS Db2 实例，由于用户无法更改自己的密码，因此您必须在单独的秘密中提供管理员凭证。

```
{
  "engine": "db2",
  "host": "<instance host name/resolvable DNS name>",
  "username": "<username>",
  "password": "<password>",
  "dbname": "<database name. If not specified, defaults to None>",
  "port": <TCP port number. If not specified, defaults to 3306>,
  "masterarn": "<ARN of the elevated secret>",
  "dbInstanceIdentifier": <optional: ID of the instance. Alternately, use dbClusterIdentifier. Required for configuring rotation in the console.>",
  "dbClusterIdentifier": <optional: ID of the cluster. Alternately, use dbInstanceIdentifier. Required for configuring rotation in the console.>"
}
```

------
#### [ MariaDB ]

```
{
  "engine": "mariadb",
  "host": "<instance host name/resolvable DNS name>",
  "username": "<username>",
  "password": "<password>",
  "dbname": "<database name. If not specified, defaults to None>",
  "port": <TCP port number. If not specified, defaults to 3306>,
  "masterarn": "<optional: ARN of the elevated secret. Required for the 轮换策略：交替用户.>",
  "dbInstanceIdentifier": <optional: ID of the instance. Alternately, use dbClusterIdentifier. Required for configuring rotation in the console.>",
  "dbClusterIdentifier": <optional: ID of the cluster. Alternately, use dbInstanceIdentifier. Required for configuring rotation in the console.>"
}
```

------
#### [ MySQL ]

```
{
  "engine": "mysql",
  "host": "<instance host name/resolvable DNS name>",
  "username": "<username>",
  "password": "<password>",
  "dbname": "<database name. If not specified, defaults to None>",
  "port": <TCP port number. If not specified, defaults to 3306>,
  "masterarn": "<optional: ARN of the elevated secret. Required for the 轮换策略：交替用户.>",
  "dbInstanceIdentifier": <optional: ID of the instance. Alternately, use dbClusterIdentifier. Required for configuring rotation in the console.>",
  "dbClusterIdentifier": <optional: ID of the cluster. Alternately, use dbInstanceIdentifier. Required for configuring rotation in the console.>"
}
```

------
#### [ Oracle ]

```
{
  "engine": "oracle",
  "host": "<instance host name/resolvable DNS name>",
  "username": "<username>",
  "password": "<password>",
  "dbname": "<database name>",
  "port": <TCP port number. If not specified, defaults to 1521>,
  "masterarn": "<optional: ARN of the elevated secret. Required for the 轮换策略：交替用户.>",
  "dbInstanceIdentifier": <optional: ID of the instance. Alternately, use dbClusterIdentifier. Required for configuring rotation in the console.>",
  "dbClusterIdentifier": <optional: ID of the cluster. Alternately, use dbInstanceIdentifier. Required for configuring rotation in the console.>"
}
```

------
#### [ Postgres ]

```
{
  "engine": "postgres",
  "host": "<instance host name/resolvable DNS name>",
  "username": "<username>",
  "password": "<password>",
  "dbname": "<database name. If not specified, defaults to 'postgres'>",
  "port": <TCP port number. If not specified, defaults to 5432>,
  "masterarn": "<optional: ARN of the elevated secret. Required for the 轮换策略：交替用户.>",
  "dbInstanceIdentifier": <optional: ID of the instance. Alternately, use dbClusterIdentifier. Required for configuring rotation in the console.>",
  "dbClusterIdentifier": <optional: ID of the cluster. Alternately, use dbInstanceIdentifier. Required for configuring rotation in the console.>"
}
```

------
#### [ SQLServer ]

```
{
  "engine": "sqlserver",
  "host": "<instance host name/resolvable DNS name>",
  "username": "<username>",
  "password": "<password>",
  "dbname": "<database name. If not specified, defaults to 'master'>",
  "port": <TCP port number. If not specified, defaults to 1433>,
  "masterarn": "<optional: ARN of the elevated secret. Required for the 轮换策略：交替用户.>",
  "dbInstanceIdentifier": <optional: ID of the instance. Alternately, use dbClusterIdentifier. Required for configuring rotation in the console.>",
  "dbClusterIdentifier": <optional: ID of the cluster.Alternately, use dbInstanceIdentifier.  Required for configuring rotation in the console.>"
}
```

------

## Amazon Redshift 凭证
<a name="reference_secret_json_structure_RS"></a>

要使用 [Secrets Manager 提供的轮换函数模板](reference_available-rotation-templates.md#template-redshift)，请使用以下 JSON 结构。例如，您可以添加更多 key/value 对，以包含其他区域中副本数据库的连接信息。

```
{
  "engine": "redshift",
  "host": "<instance host name/resolvable DNS name>",
  "username": "<username>",
  "password": "<password>",
  "dbname": "<database name. If not specified, defaults to None>",
  "dbClusterIdentifier": "<optional: database ID. Required for configuring rotation in the console.>"
  "port": <optional: TCP port number. If not specified, defaults to 5439>
  "masterarn": "<optional: ARN of the elevated secret. Required for the 轮换策略：交替用户.>"
}
```

## Amazon Redshift Serverless 凭证
<a name="reference_secret_json_structure_RSServerless"></a>

要使用 [Secrets Manager 提供的轮换函数模板](reference_available-rotation-templates.md#template-redshift)，请使用以下 JSON 结构。例如，您可以添加更多 key/value 对，以包含其他区域中副本数据库的连接信息。

```
{
  "engine": "redshift",
  "host": "<instance host name/resolvable DNS name>",
  "username": "<username>",
  "password": "<password>",
  "dbname": "<database name. If not specified, defaults to None>",
  "namespaceName": "<optional: namespace name, Required for configuring rotation in the console.> "
  "port": <optional: TCP port number. If not specified, defaults to 5439>
  "masterarn": "<optional: ARN of the elevated secret. Required for the 轮换策略：交替用户.>"
}
```

## Amazon DocumentDB 凭证
<a name="reference_secret_json_structure_docdb"></a>

要使用 [Secrets Manager 提供的轮换函数模板](reference_available-rotation-templates.md#NON-RDS_rotation_templates)，请使用以下 JSON 结构。例如，您可以添加更多 key/value 对，以包含其他区域中副本数据库的连接信息。

```
{
  "engine": "mongo",
  "host": "<instance host name/resolvable DNS name>",
  "username": "<username>",
  "password": "<password>",
  "dbname": "<database name. If not specified, defaults to None>",
  "port": <TCP port number. If not specified, defaults to 27017>,
  "ssl": <true|false. If not specified, defaults to false>,
  "masterarn": "<optional: ARN of the elevated secret. Required for the 轮换策略：交替用户.>",
  "dbClusterIdentifier": "<optional: database cluster ID. Alternately, use dbInstanceIdentifier. Required for configuring rotation in the console.>"
  "dbInstanceIdentifier": "<optional: database instance ID. Alternately, use dbClusterIdentifier. Required for configuring rotation in the console.>"
}
```

## Amazon Timestream for InfluxDB 密钥结构
<a name="reference_secret_json_structure_TIME"></a>

要轮换 Timestream 密钥，您可以使用 [Amazon Timestream for InfluxDB](reference_available-rotation-templates.md#template-TimeStream) 轮换模板。

有关更多信息，请参阅《*Amazon Timestream 开发人员指南*》中的 [Amazon Timestream for InfluxDB 如何使用密钥](https://docs.aws.amazon.com/timestream/latest/developerguide/timestream-for-influx-security-db-secrets.html)。

Timestream 密钥必须采用正确的 JSON 结构才能使用轮换模板。有关更多信息，请参阅《*Amazon Timestream 开发人员指南*》中的[密钥的内容](https://docs.aws.amazon.com/timestream/latest/developerguide/timestream-for-influx-security-db-secrets.html#timestream-for-influx-security-db-secrets-definition)。

## Amazon ElastiCache 凭证
<a name="reference_secret_json_structure_ELC"></a>

以下示例显示了存储 ElastiCache 凭证的密钥的 JSON 结构。

```
{
  "password": "<password>",
  "username": "<username>" 
  "user_arn": "ARN of the Amazon EC2 user"
}
```

有关更多信息，请参阅 *Amazon 用户指南中的自动轮换 ElastiCache 用户*[密码](https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/User-Secrets-Manager.html)。

## Active Directory 凭证
<a name="reference_secret_json_structure_AD"></a>

AWS Directory Service 使用密钥来存储活动目录凭证。有关更多信息，请参阅《*AWS Directory Service 管理指南*》中的 [Seamlessly join an Amazon EC2 Linux instance to your Managed AD Active Directory](https://docs.aws.amazon.com/directoryservice/latest/admin-guide/seamlessly_join_linux_instance.html)。无缝加入域名需要以下示例中的键名称。如果不使用无缝域加入，则可以使用环境变量更改密钥中键的名称，如轮换函数模板代码中所述。

要轮换 Active Directory 密钥，您可以使用 [Active Directory 轮换模板](reference_available-rotation-templates.md#template-AD)。

------
#### [ Active Directory credential ]

```
{
  "awsSeamlessDomainUsername": "<username>",
  "awsSeamlessDomainPassword": "<password>"
}
```

如果要轮换密钥，请包括域目录 ID。

```
{
  "awsSeamlessDomainDirectoryId": "d-12345abc6e",
  "awsSeamlessDomainUsername": "<username>",
  "awsSeamlessDomainPassword": "<password>"
}
```

如果将该密钥与包含密钥表的密钥一起使用，则将该密钥表密钥包括在内。 ARNs

```
{
  "awsSeamlessDomainDirectoryId": "d-12345abc6e",
  "awsSeamlessDomainUsername": "<username>",
  "awsSeamlessDomainPassword": "<password>",
  "directoryServiceSecretVersion": 1,
  "schemaVersion": "1.0",
  "keytabArns": [
    "<ARN of child keytab secret 1>,
    "<ARN of child keytab secret 2>,
    "<ARN of child keytab secret 3>,
  ],
  "lastModifiedDateTime": "2021-07-19 17:06:58"
}
```

------
#### [ Active Directory keytab ]

有关使用 keytab 文件对 Amazon EC2 上的 Active Directory 账户进行身份验证的信息，请参阅 [Deploying and configuring Active Directory authentication with SQL Server 2017 on Amazon Linux 2](https://aws.amazon.com/blogs/database/deploying-and-configuring-active-directory-authentication-with-sql-server-2017-on-amazon-linux-2/)。

```
{
  "awsSeamlessDomainDirectoryId": "d-12345abc6e",
  "schemaVersion": "1.0",
  "name": "< name>",
  "principals": [
    "aduser@MY.EXAMPLE.COM",
    "MSSQLSvc/test:1433@MY.EXAMPLE.COM"
  ],
  "keytabContents": "<keytab>",
  "parentSecretArn": "<ARN of parent secret>",
  "lastModifiedDateTime": "2021-07-19 17:06:58"
  "version": 1
}
```

------